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DETAILED ACTION 

The following is a Non-Final First Office Action in response to the Patent Application 
filed October 24, 2003. Claims 1-20, as originally filed are presented for examination on the 
merits. 

Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1-6, 8-10 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Annie I. Anton, Julia B. Earp, Angela Reese; IEEE, Sept. 2002 Pgs. 23-31: "Analyzing 
Website privacy requirements using a privacy goal taxonomy" (hereinafter referred as Anton) 
in view of Bleizeffer et al. US 2002/0188572 (hereinafter referred as Bleizeffer). 

As per claim 1, Anton discloses a method, comprising: comparing user concerns with a 
Web site privacy policy to determine if any portion of the Web site privacy policy conflicts with 
one or more of the user ( ]f [2.2- users preferences are compared with P3P complaint policy 
statements]; see also, If [3- consumers and system developers can more accurately compare 
privacy practices]), transforming the Web site privacy policy to emphasize portions of the Web 
site privacy policy that conflict with the user concerns ( [3.1 .3- allow customer to 
modify/remove their personal identification information]); 
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Anton fails to disclose displaying the transformed Web site privacy policy so that the 
emphasized portions of the Web site privacy policy are demarcated from other portions of the 
Web site privacy policy. 

Bleizeffer teaches and interface that displays privacy policy preferences specifications ( If 
[0006-0007 interface displays descriptions of the privacy policy in several forms]; see also, Tf 
[0003 screen that displays the main policy editor window]). 

Therefore it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the internet privacy policy analysis as taught by Anton to include the screen 
interface display as taught by Bleizeffer in order to output the revised privacy policy that meets 
with the user and service provider preferences that will serve as an effective mechanism for 
analyzing and comparing privacy policies, system requirements and the respective system's 
functionality. 

As per claim 2, Anton further discloses collecting user concerns from a user fl[ [3.1.1 - 
information is collected from consumers]; see also, U [3.2.2- information transfer or information 
collection). 

As per claim 3, Anton discloses claim 2 as rejected above wherein Bleizeffer further 
teaches collecting the user concerns from a user via a concerns settings user interface flf [0002, 
0007, 0019-interface for creating and designing privacy policies for the platform for privacy 
preferences specifications]). 

As per claim 4, Anton further discloses the Web site privacy policy includes one or more 
policy statements flf [5- policy statements]); the comparing further comprises comparing each 
privacy policy statement with each user concern fl[ [2.2- user multiple choice question responses 
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are compare with P3P complaint policy statements]); and a conflict is identified when there is a 
conflict between a privacy policy statement and a user concern flf [1- conflicts with consumers' 
desires to be shielded from unauthorized personal information use]; see also, Tf [3-conflicts 
within privacy policies and conflicts with the corresponding websites and their manner of 
operation]). 

As per claim 5, Anton discloses claim 1 as rejected above wherein Bleizeffer further 
teaches the privacy policy further comprises a policy file that conforms to P3P (Platform for 
Privacy Preferences Project) standards fl[ [0007, 0029-P3P specification]; see also, If [0039-P3P 
standard]). 

As per claim 6, Anton discloses claim 1 as rejected above wherein Bleizeffer further 
teaches the privacy policy is contained in an XML (extensible Markup Language) file flf [0033- 
XML policy]; see also, U [0040- the formal extensible markup language version of the policy is 
available]). 

As per claim 8, Anton further discloses notifying the user that a conflict exists between 
the user concerns and the Web site privacy policy file fl[ [3. 1.1 -notice and awareness notification 
regarding site's privacy policy]). 

As per claim 9, Anton discloses claim 1 as rejected above wherein Bleizeffer further 
teaches wherein the displaying is only performed upon the user indicating that the user wants the 
transformed Web site privacy policy to be displayed (]} [0033-tabs 432 allow the user to switch 
between versions of the policy displayed in the policy pane]; see also, K [0040-policy pane]) 
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As per claim 10, Anton discloses claim 1 as rejected above wherein Bleizeffer further 
teaches wherein the comparing, transforming and displaying steps are only performed when the 
user explicitly initiates a policy analysis flf [0006, 0038- interview type user questions). 

Claim 7 is rejected under 35 U.S.C. 103(a) as being unpatentable over Anton in view 
of www.w3schools.com (W3Sschools XSL Languages); Note: that the earliest date 
Examiner could find that "W3Schools" was available is indicated by a copyright of 1999- 
2008. 

As per claim 7, Anton discloses claim 1 as rejected above but does not explicitly disclose 
wherein the transforming step further comprises an XSL (extensible Stylesheet Language) 
transformation. 

W3 Schools teaches a tutorial about XSL languages (pg.l, XSL = XML style sheets, 
XML consists of three parts: XSLT-a language for transforming XML documents, XPath- a 
language for navigating in XML documents, XSL-FO- a language for formatting XML 
documents). 

Therefore it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the internet privacy policy analysis of Anton by providing an XSL computer 
language for transforming XML documents as taught by W3 Schools in order to display the XML 
documents in XSL computer language. 

Claims 11-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Bleizeffer in view of Koike (US 2003/0084300 Al). 

As per claim 11, Bleizeffer discloses a system, comprising: a user concerns menu that is 
configured to allow a user to enter user concerns that are privacy concern preferences that apply 
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to browsing Web sites flf [0006- interface for creating privacy policies]; see also, Tf [0030, 003 1- 
main policy editor window]); a Web browser configured to allow the user to access one or more 
network Web sites flf [0017-0018, 0029- network 102 being the internet and a web server 
providing world wide web content; see also fig. 1 and associated text]); a transformation module 
configured to transform the privacy policy file into a user-centric policy display that emphasizes 
one or more portions of the privacy policy file that conflict with the user concerns flf [0033-tabs 
432 allow the user to switch between versions of the policy displayed in the policy pane]; see 
also, T[ [0040-policy pane]); and a user interface module configured to display a user interface 
that includes at least the portions of the privacy policy file that conflict with the user concerns flf 
[0007- interface that allows user to group, manipulate, and describe the data used by a Web 
site]; see also, [0052- policy editor interface]). 

Bleizeffer does not disclose a trust engine configured to compare the user concerns with a 
privacy policy file included in a Web site and to identify conflicts between the user concerns and 
the privacy policy file. 

Koike teaches a comparator the compares the privacy policy to privacy preferences and 
judges whether the privacy policy is consistent with the privacy policy (Tl [0090, 0095, 0116- 
comparator 104 compares the privacy policy]). 

Therefore it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the privacy policy system of Bleizeffer to include a comparator as taught by 
Koike in order to acquire a policy that's in accordance with the results of comparison carried out 
by the comparator and is acceptable to a user. 
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As per claim 12, Bleizeffer discloses claim 1 1 as rejected above wherein Koike further 
teaches wherein the trust engine is further configured to compare each user concern with each of 
multiple statements making up the privacy policy file and to identify a match when a statement is 
found that contradicts a user concern flf [01 16, 0121- comparator 104 outputs not only the results 
of comparison but also data indicative of inconsistency between the privacy policy and the 
privacy preferences]). 

As per claim 13, Bleizeffer further discloses wherein the Web browser is further 
configured to provide a conflict notification when there is a conflict between a user concern and 
the privacy policy file flf [0040- policy pane that displays an error tab when errors are detected in 
the policy]). 

As per claim 14, Bleizeffer discloses claim 1 1 as rejected above wherein Koike further 
teaches wherein the Web browser is further configured to provide a privacy actuator that, when 
activated, initiates the comparing, transformation and display (]] [0090-central processing unit 
and comparator 104]). 

As per claim 15, Bleizeffer discloses wherein the user interface module is further 
configured to display a user interface that displays the portions of the privacy policy file that 
conflict with the user concerns more prominently than the portions of the privacy policy file that 
do not conflict with the user concerns (]f [0007- interface that allows user to group, manipulate, 
and describe the data used by a Web site]; see also, T) [0052- policy editor interface]). 

As per claim 16, Bleizeffer discloses one or more computer-readable media including 
computer-executable instructions that, when executed on a computer, perform the following 
steps: if a conflict is identified between a user concern and a privacy policy statement, 
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transforming the privacy policy statements for presentation to a user so that the privacy policy 
statement is emphasized over other, non-conflicting privacy policy statements flf [0064- 
computer readable media]; see also, K [0007- interface that allows user to group, manipulate, and 
describe the data used by a Web site]; see also, T) [0052- policy editor interface]); and displaying 
a user interface that presents the privacy policy statements in the transformed state flf [0063- 
Interface used to define new data elements and a policy that is displayed in several forms]). 

Bleizeffer does not disclose comparing a set of user concerns with a set of Web site 
privacy policy statements to determine if a privacy policy statement conflicts with a user 
concern. 

Koike teaches a recording medium storing a computer program capable of executing a 
user terminal device to output a warning to a user and compare the received privacy policy to 
privacy preferences fl| [0179-0183 recording medium storing the program]; see also, U [0010, 
00 13 -user terminal device]). 

Therefore it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the privacy policy statement of Bleizeffer to include a user terminal device 
as taught by Koike in order for the user avoid errors and provide user feedback when errors do 
occur. 

As per claim 17, Bleizeffer discloses claim 16 as rejected above wherein Koike further 
teaches collecting the set of user concerns from a user (][ [0032-server for collecting data 
including privacy of the user; see fig. 1, server 1 10, and associated text]). 

As per claim 18, Bleizeffer discloses claim 16 as rejected above wherein Koike further 
teaches receiving a prompt from a user before executing the comparing and the displaying (]f 
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[0179-0183 recording medium storing the program]; see also, [0010, 0013-user terminal device 
to output a warning to a user and compare the received privacy policy to a privacy preferences]). 

As per claim 19, Bleizeffer further discloses providing a conflict notification to a user to 
inform the user that a conflict has been found to exist between the privacy policy statements and 
the user concerns flf [0040- policy pane that displays an error tab when errors are detected in the 
policy]). 

As per claim 20, Bleizeffer further discloses providing a conflict notification to a user to 
inform the user that a conflict has been found to exist between the privacy policy statements and 
the user concerns, and only performing the displaying upon detection of a user response to the 
conflict notification (]} [0040- policy pane that displays an error tab when errors are detected in 
the policy]). 

Examiner has pointed out particular references contained in the prior arts of record in 
the body of this action for the convenience of the applicant. Although the specified citations 
are representative of the teachings in the art and are applied to the specific limitations within 
the individual claim, other passages and figures may apply as well. It is respectfully requested 
from the applicant, in preparing the response, to consider fully the entire references as 
potentially teaching all or part of the claimed invention, as well as the context of the passage as 
taught by the prior arts or disclosed by the examiner. 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

• Aarts et al. (US 2005/0076233) Method and apparatus for transmitting data subject to 
privacy restrictions. 
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• Cranor, Faith, and Reagle, Joseph. (Feb. 1999/Vol. 42, No.2 Communication of the 
ACM) The platform for privacy preferences. 

• Arjula, Manjula; Cranor, Lorrie Faith, and Guduru, Praveen. (Nov. 2002 ACM 1-58113- 
633-1/02/001) Use of a P3P user agent by early adopters. 

• Bari et al. (US 7,155,739 B2) Method and system for secure registration, storage, 
management and linkage of personal authentication credentials data over a network. 

• Feng et al. (US 2004/0083243) Privacy preferences roaming and enforcement. 

• Duri et al. (US 2004/0054919 Al) Secure system and method for enforcement of privacy 
policy and protection of confidentiality. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to BOB CHUMPITAZ whose telephone number is (571)270-5494. 
The examiner can normally be reached on M-TR: 7:30 AM - 6:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, BRADLEY BAY AT can be reached on (571) 272-6704. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
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system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

B.C. 

Examiner, Art Unit 4115 



/Bradley B Bayat/ 

Supervisory Patent Examiner, Art Unit 4115 



